change user from undefined
Merge pull request #122 from krulwich/bug/password-undefined-user

Password module shouldn't read from database with undefined user argument